Measured event size · Managed endpoint
Mac OS log size: 145 bytes per event
The average Mac OS event is 145 bytes, measured from samples of its logs. A managed endpoint source typically produces 10 events per second per device, bursting to 100: detections only is far lower, full telemetry far higher. The rate is an informed estimate; the size is measured.
What that comes to
One device, raw bytes, at the typical rate for a managed endpoint source.
| Period | At 10 events/s | At the 100 events/s burst |
|---|---|---|
| An hour | 5.2 MB | 52.2 MB |
| A day | 125 MB | 1.3 GB |
| 90 days | 11.3 GB | 113 GB |
| A year | 45.7 GB | 457 GB |
A day of Mac OS logs from one device at the category's typical rate, 125 MB, is about 2 times an hour of Spotify.
Size your own
Raw bytes, before compression, indexing overhead and replication.
Measure a sample of your own
The figure above is an average; yours will differ, and for Mac OS what moves it most is this: detections only is far lower, full telemetry far higher. The profiler reads a sample from Mac OS in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.
Other managed endpoint sources
- Crowdstrike540 B
- CarbonBlack500 B
- Tanium500 B
The managed endpoint category: its typical rate and every source in it →
Logcaliper, free on iOS, has these sizes and rates built in and sizes a whole list of sources at retention: storage, cluster capacity, nodes.